{"id":10173,"date":"2011-07-13T07:00:00","date_gmt":"2011-07-13T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2011\/07\/13\/what-does-the-executable-timestamp-really-mean\/"},"modified":"2011-07-13T07:00:00","modified_gmt":"2011-07-13T07:00:00","slug":"what-does-the-executable-timestamp-really-mean","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20110713-00\/?p=10173\/","title":{"rendered":"What does the executable timestamp really mean?"},"content":{"rendered":"

A customer was looking for some information on the executable timestamp:<\/p>\n

I would like my program to display the date it was linked. The IMAGE_FILE_HEADER.Time­Date­Stamp<\/code> looks like what I need. Is there an easy way to retrieve this information so I don’t have to parse the EXE header myself? Also, what functions exist for formatting this timestamp into something human-readable? <\/p><\/blockquote>\n

The customer didn’t explain why they needed this information, but presumably it was for diagnostic purposes. For example, the program might display the information in the About<\/i> box to help the product support team identify which version of the program the end-user is running.\n We’ll answer the questions in reverse order, and then answer a question that wasn’t even asked.\n The timestamp is a Unix-style time_t<\/code> timestamp<\/a>; therefore, you can use the ctime<\/code> function to convert it to text. If there is a particular format you like, you can use the appropriate time formatting function (though you may have to convert it first<\/a>).\n If you want to retrieve this value, you can use helper functions in the imagehlp<\/code> library<\/a>; the one most applicable here appears to be Image­Nt­Header<\/code> or even Get­Time­stamp­For­Loaded­Library<\/code>.<\/p>\n

The unasked question is “Does this in fact give me the date and time that the image was linked?” Fortunately, I don’t have to write out the answer to this question, because I answered it last year<\/a>. The name timestamp<\/i> is misleading. Its real purpose is to act as a signature so that the operating system can determine whether a DLL against which one set of values was precalculated matches the DLL physically on the system. A better name for it would have been UniqueId<\/code>. <\/p>\n","protected":false},"excerpt":{"rendered":"

A customer was looking for some information on the executable timestamp: I would like my program to display the date it was linked. The IMAGE_FILE_HEADER.Time­Date­Stamp looks like what I need. Is there an easy way to retrieve this information so I don’t have to parse the EXE header myself? Also, what functions exist for formatting […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-10173","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"

A customer was looking for some information on the executable timestamp: I would like my program to display the date it was linked. The IMAGE_FILE_HEADER.Time­Date­Stamp looks like what I need. Is there an easy way to retrieve this information so I don’t have to parse the EXE header myself? Also, what functions exist for formatting […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/10173","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=10173"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/10173\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=10173"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=10173"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=10173"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}